Research from the University of Maryland’s Center for the Governance of Technology and Systems (GoTech) was recently published and presented at the 25th European Conference on Cyber Warfare and Security (ECCWS 2026), hosted by the University of Nottingham.
The conference paper, titled “The University of Maryland’s Cyber Events Database 2.0: A Systematic Framework for Analyzing Global Cyber Threats,” is co-authored by GoTech Director, Dr. Charles Harry, research fellow, Devin Entrikin, and former research director, William Lucyshyn.
Entrikin presented the research this past summer as a part of the ECCWS virtual program. The conference paper introduces the Cyber Events Database 2.0 (CEDB 2.0) as a publicly sourced, event-level repository designed to support reproducible research and strategic cybersecurity analysis.
Entrikin also presented on the CEDB 2.0 at the CAE Annual Symposium plenary session this past Spring in Pittsburgh. The symposium brings together cybersecurity researchers from a range of Center of Academic Excellence in Cybersecurity institutions.
Cyberattacks are increasing in scale, scope, and impact. Yet systematic and accessible data on these events remains fragmented, narrowly scoped, or methodologically opaque. Many existing cyber incident datasets focus on specific threat types, high-profile cases, or state-attributed operations. Others are proprietary or lack transparent coding rules, limiting comparative analysis and cumulative research.
The CEDB 2.0 was developed to address these limitations.
“Much of the scholarly debates and practitioner’s questions around cyber conflict lack a strong foundation in event-level cyber data,” said Harry. “This project looks to provide a longer term contribution to the field through open-source collection and systematic coding of observed operations.”Dr. Charles Harry Director of the Center for Governance of Technology and Systems (GoTech)
As of September 2026, the database contains 17,753 coded cyber events across 186 countries and 1,610 distinct threat actors, with new records added monthly. Each event is classified using a theory-informed taxonomy that captures actor type, motive, target sector, affected country, and observable effects.
The database employs a mixed-methods data collection approach that combines automated web scraping with multilingual, near–real-time news monitoring. Beginning in 2025, the project integrated the Global Database of Events, Language, and Tone (GDELT) Project to expand global coverage and reduce English-language reporting bias.
The presentation at ECCWS 2026 contributes to broader academic discussions about how cyber operations should be measured, categorized, and analyzed empirically. By employing an effects-based classification framework, categorizing events according to their observable operational impact rather than solely by tactic or attribution, the Cyber Events Database 2.0 emphasizes transparency, reproducibility, and theory-informed coding. This approach provides a foundation for moving beyond anecdotal case studies toward systematic, evidence-based assessment of state and non-state cyber behavior.
One ongoing application of the dataset focuses on Russian cyber activity directed at NATO member states since 2014. By leveraging structured event-level data, the project analyzes targeting patterns, operational tempo, and potential indicators of coordination across criminal, hacktivist, and nation-state actors over more than a decade of geopolitical tension.
The database is publicly accessible through GoTech’s interactive web platform, allowing users to explore records, visualize trends, and download structured data for independent analysis.
